Data Processing and Sharing Agreement

This Data Processing and Sharing Agreement ("DPSA") forms part of the agreement between Glow Up Hub, operated by K&L Collective Pty Ltd (ACN 699 071 746) ("Glow Up Hub", "we", "us"), and the Customer ("you", "salon owner") who subscribes to and uses the Glow Up Hub platform ("Platform").

This DPSA should be read together with our Terms and Conditions and Privacy Policy. By accepting our Terms and Conditions, you also accept the terms of this DPSA.

1. Definitions

"Customer Content" means all documents, policies, procedures, staff information, and other materials uploaded to the Platform by the Customer or their Staff Users.

"Platform Content" means content created and managed by Glow Up Hub that is made available across all Customer accounts, including national laws, industry regulations, compliance updates, and general beauty industry guidance.

"Personal Data" means any information that identifies or could reasonably identify an individual, as defined under the Australian Privacy Act 1988 (Cth).

"Staff Users" means individuals authorised by the Customer to access the Platform on behalf of the Customer's business.

"Sub-processor" means any third party engaged by Glow Up Hub to process data in connection with the Platform.

"Authorised Access" means access by Glow Up Hub or its development team to a Customer's account, granted only with the Customer's prior approval via the Platform's access request process.

2. Roles and Responsibilities

2.1 Customer as Data Controller for Customer Content

In relation to Customer Content, you are the data controller. This means you are responsible for:

• determining what content is uploaded to the Platform and ensuring it is lawful to upload;
• ensuring that any personal data contained in Customer Content (such as staff names and contact details) is collected and held in compliance with the Australian Privacy Act 1988 (Cth);
• obtaining any necessary consents from Staff Users for their personal information to be stored on the Platform; and
• ensuring that Customer Content does not include your clients' personal information, health records, or other sensitive data not necessary for staff training and knowledge management purposes.

2.2 Glow Up Hub as Data Processor for Customer Content

In relation to Customer Content, Glow Up Hub acts as your data processor. This means we:

• store and process Customer Content solely for the purpose of providing the Platform services to you;
• do not use Customer Content for any purpose beyond delivering the Platform to you;
• do not share Customer Content with any other Customer or use it to train any other Customer's AI Staff Assistant;
• do not use Customer Content to train or improve our general platform systems; and
• process Customer Content only in accordance with your instructions and this DPSA.

2.3 Glow Up Hub as Data Controller for Platform Content

In relation to Platform Content, Glow Up Hub acts as the data controller. This means we are solely responsible for:

• the accuracy, currency, and lawfulness of Platform Content;
• decisions about what Platform Content is made available on the Platform;
• updating Platform Content when laws, regulations, or industry standards change; and
• notifying Customers when material Platform Content changes are made that may affect their business operations.

3. What Data We Process

As your data processor, Glow Up Hub processes the following categories of data on your behalf:

• business name, ABN, and business contact details provided at account setup;
• Staff User names and email addresses added to your account;
• documents, SOPs, policies, and procedures uploaded by you or your Staff Users; and
• usage logs and interaction data generated by your account and Staff Users within the Platform.

We do not require and strongly advise against the inclusion of the following in Customer Content:

• your clients' personal information including names, contact details, or health records;
• payment card or financial account details; or
• government-issued identification numbers.

If you inadvertently upload content containing your clients' personal information, please contact us immediately at hello@glowuphub.com.au so we can assist you in removing it.

4. Isolated Data Architecture

Each Customer's account operates within a fully isolated data environment. This means:

• your Customer Content is accessible only to you and your authorised Staff Users;
• your AI Staff Assistant is trained exclusively on your Customer Content and applicable Platform Content;
• no other Customer can access, view, or benefit from your Customer Content; and
• Glow Up Hub personnel cannot access your account without your explicit prior approval through the Platform's Authorised Access process.

5. Authorised Access by Glow Up Hub

5.1 Access Request Process

Glow Up Hub and its development and support team may only access your account after submitting a formal access request through the Platform. You will receive a notification of the request and must approve it before any access is granted. We will not access your account without your prior approval except in the circumstances described in clause 5.2.

5.2 Emergency Access

In exceptional circumstances, including a critical security incident, data breach, or where required by law, Glow Up Hub may access account data without prior approval. In these circumstances we will notify you of the access as soon as practicable and provide a written explanation of the reason for access.

5.3 Access Audit Log

A complete and timestamped record of every instance of Glow Up Hub or development team access to your account is maintained and visible to you within your account settings at all times. This log cannot be modified or deleted by Glow Up Hub.

6. Sub-processors

Glow Up Hub engages the following sub-processors in connection with the Platform. By accepting this DPSA, you authorise the use of these sub-processors:

Stackup Solutions (Hosting, Infrastructure and Development)

Stackup Solutions is our hosting, infrastructure, and development partner. Customer Content is stored on servers located in Paris, France. We use the hosting provider's native DNS services and do not use Cloudflare or any other third-party DNS provider. Stackup Solutions may access platform infrastructure for maintenance, debugging, and development purposes. Any access to individual Customer accounts requires Authorised Access approval as described in clause 5.

Anthropic and OpenAI

As set out in our AI Disclosure Statement, Anthropic (Claude API) and OpenAI (Embeddings API) process Customer Content as part of delivering the AI Staff Assistant. Neither provider uses this data to train their general models under our current API terms.

We will notify you of any material changes to our sub-processors with at least 30 days notice via email before the change takes effect.

7. Platform Content and Notifications

7.1 Platform Content Availability

Glow Up Hub may from time to time make Platform Content available within your account environment. Platform Content is provided to assist salon owners in understanding applicable laws and industry standards and does not constitute legal advice. You remain responsible for ensuring your business operates in compliance with all applicable laws and regulations.

7.2 Notification of Material Updates

Where Glow Up Hub makes a material update to Platform Content, including changes to reflected laws, regulations, or compliance requirements that may affect your business operations, we will notify you by email within a reasonable timeframe of the update taking effect.

7.3 Accuracy of Platform Content

While we take reasonable care to ensure Platform Content is accurate and current, we do not warrant that it is complete, up to date, or applicable to your specific circumstances. Platform Content is provided for general guidance only.

8. Data Security

Glow Up Hub implements and maintains appropriate technical and organisational measures to protect Customer Content from unauthorised access, loss, disclosure, or alteration. These measures include:

• encrypted data transmission and storage;
• role-based access controls limiting internal access to Customer Content;
• isolated data environments per Customer account;
• mandatory Authorised Access approval for any account-level access by Glow Up Hub personnel; and
• regular review and testing of security measures.

9. Data Breach Notification

In the event of a data breach affecting Customer Content, Glow Up Hub will:

• notify you by email as soon as practicable, and in any event within 72 hours of becoming aware of the breach;
• provide details of the nature of the breach, the data affected, and the steps being taken to address it;
• cooperate with you in any notification obligations you may have to affected individuals or regulatory authorities; and
• notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

10. Retention and Deletion of Customer Content

Customer Content is retained for the duration of your active Subscription. Following cancellation or termination of your account:

• Customer Content will be retained for 30 days to allow you to request a copy;
• you may request a copy of your Customer Content by contacting hello@glowuphub.com.au within the 30-day period; and
• after 30 days, all Customer Content will be permanently and irreversibly deleted from our systems and those of our sub-processors.

Glow Up Hub will confirm in writing when deletion of Customer Content has been completed, upon request.

11. Your Obligations as Data Controller

As the data controller for Customer Content, you agree to:

• ensure that your collection and use of personal data included in Customer Content complies with the Australian Privacy Act 1988 (Cth) and all other applicable laws;
• ensure that Staff Users are aware their personal information will be stored on the Platform;
• not upload content that includes your clients' personal information, health records, or other sensitive data beyond what is necessary for staff training purposes;
• promptly notify us if you become aware of any unauthorised access to your account or any suspected data breach; and
• maintain accurate and current account and billing information.

12. Term and Termination

This DPSA comes into effect when you accept our Terms and Conditions and remains in force for the duration of your Subscription. It terminates automatically on cancellation or termination of your account, subject to the data retention and deletion obligations in clause 10, which survive termination.

13. Changes to This DPSA

We may update this DPSA from time to time. We will notify you of any material changes by email at least 30 days before the updated DPSA takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated DPSA.

14. Governing Law

This DPSA is governed by the laws of the State of Victoria, Australia, and the Australian Privacy Act 1988 (Cth). Any disputes arising under this DPSA are subject to the dispute resolution process set out in our Terms and Conditions.

15. Contact

For any questions about this DPSA or how we handle your data, please contact us: